[Security] HIGH: 34 issue(s) found in itchbox #6

New issue

Closed

opened 2026-05-14 23:23:46 +00:00 by Mark · 0 comments

Mark commented 2026-05-14 23:23:46 +00:00

Owner

Copy link

Security Scan Results for itchbox

Severity: HIGH
Findings: 34

1. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/typing_extensions.py
• File: .venv/lib/python3.12/site-packages/typing_extensions.py
• Pattern: eval_usage

2. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/skipping.py
• File: .venv/lib/python3.12/site-packages/_pytest/skipping.py
• Pattern: eval_usage

3. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/pytester.py
• File: .venv/lib/python3.12/site-packages/_pytest/pytester.py
• Pattern: eval_usage

4. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/_code/code.py
• File: .venv/lib/python3.12/site-packages/_pytest/_code/code.py
• Pattern: eval_usage

5. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/_pytest/_py/path.py
• File: .venv/lib/python3.12/site-packages/_pytest/_py/path.py
• Pattern: exec_usage

6. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/mark/init.py
• File: .venv/lib/python3.12/site-packages/_pytest/mark/__init__.py
• Pattern: eval_usage

7. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/mark/expression.py
• File: .venv/lib/python3.12/site-packages/_pytest/mark/expression.py
• Pattern: eval_usage

8. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.py
• File: .venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.py
• Pattern: exec_usage

9. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_internal/utils/setuptools_build.py
• File: .venv/lib/python3.12/site-packages/pip/_internal/utils/setuptools_build.py
• Pattern: exec_usage

10. auth_flaw

• Details: Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_internal/network/session.py
• File: .venv/lib/python3.12/site-packages/pip/_internal/network/session.py
• Pattern: disable_ssl_verify

11. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/six.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/six.py
• Pattern: exec_usage

12. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py
• Pattern: eval_usage

13. auth_flaw

• Details: Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py
• Pattern: disable_ssl_verify

14. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pkg_resources/init.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/pkg_resources/__init__.py
• Pattern: exec_usage

15. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/init.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.py
• Pattern: eval_usage

16. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pygments/lexers/init.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/pygments/lexers/__init__.py
• Pattern: exec_usage

17. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py
• Pattern: eval_usage

18. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/packages/six.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/packages/six.py
• Pattern: exec_usage

19. auth_flaw

• Details: Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py
• File: .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py
• Pattern: disable_ssl_verify

20. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/jinja2/debug.py
• File: .venv/lib/python3.12/site-packages/jinja2/debug.py
• Pattern: exec_usage

21. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/jinja2/nodes.py
• File: .venv/lib/python3.12/site-packages/jinja2/nodes.py
• Pattern: eval_usage

22. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/jinja2/environment.py
• File: .venv/lib/python3.12/site-packages/jinja2/environment.py
• Pattern: exec_usage

23. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/typing_inspection/typing_objects.py
• File: .venv/lib/python3.12/site-packages/typing_inspection/typing_objects.py
• Pattern: exec_usage

24. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/anyio/to_interpreter.py
• File: .venv/lib/python3.12/site-packages/anyio/to_interpreter.py
• Pattern: exec_usage

25. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/sql/lambdas.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/sql/lambdas.py
• Pattern: exec_usage

26. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/util/langhelpers.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/util/langhelpers.py
• Pattern: exec_usage

27. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/util/typing.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/util/typing.py
• Pattern: eval_usage

28. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/testing/plugin/pytestplugin.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/testing/plugin/pytestplugin.py
• Pattern: exec_usage

29. auth_flaw

• Details: Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/instrumentation.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/orm/instrumentation.py
• Pattern: exec_usage

30. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/clsregistry.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/orm/clsregistry.py
• Pattern: eval_usage

31. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/_orm_constructors.py
• File: .venv/lib/python3.12/site-packages/sqlalchemy/orm/_orm_constructors.py
• Pattern: eval_usage

32. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/_internal/_namespace_utils.py
• File: .venv/lib/python3.12/site-packages/pydantic/_internal/_namespace_utils.py
• Pattern: eval_usage

33. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/_internal/_typing_extra.py
• File: .venv/lib/python3.12/site-packages/pydantic/_internal/_typing_extra.py
• Pattern: eval_usage

34. auth_flaw

• Details: Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/v1/utils.py
• File: .venv/lib/python3.12/site-packages/pydantic/v1/utils.py
• Pattern: eval_usage

---

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `itchbox` **Severity:** HIGH **Findings:** 34 ### 1. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/typing_extensions.py - **File:** `.venv/lib/python3.12/site-packages/typing_extensions.py` - **Pattern:** `eval_usage` ### 2. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/skipping.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/skipping.py` - **Pattern:** `eval_usage` ### 3. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/pytester.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/pytester.py` - **Pattern:** `eval_usage` ### 4. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/_code/code.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/_code/code.py` - **Pattern:** `eval_usage` ### 5. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/_pytest/_py/path.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/_py/path.py` - **Pattern:** `exec_usage` ### 6. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/mark/__init__.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/mark/__init__.py` - **Pattern:** `eval_usage` ### 7. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/_pytest/mark/expression.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/mark/expression.py` - **Pattern:** `eval_usage` ### 8. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.py - **File:** `.venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.py` - **Pattern:** `exec_usage` ### 9. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_internal/utils/setuptools_build.py - **File:** `.venv/lib/python3.12/site-packages/pip/_internal/utils/setuptools_build.py` - **Pattern:** `exec_usage` ### 10. auth_flaw - **Details:** Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_internal/network/session.py - **File:** `.venv/lib/python3.12/site-packages/pip/_internal/network/session.py` - **Pattern:** `disable_ssl_verify` ### 11. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/six.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/six.py` - **Pattern:** `exec_usage` ### 12. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py` - **Pattern:** `eval_usage` ### 13. auth_flaw - **Details:** Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py` - **Pattern:** `disable_ssl_verify` ### 14. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pkg_resources/__init__.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/pkg_resources/__init__.py` - **Pattern:** `exec_usage` ### 15. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.py` - **Pattern:** `eval_usage` ### 16. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pygments/lexers/__init__.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/pygments/lexers/__init__.py` - **Pattern:** `exec_usage` ### 17. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py` - **Pattern:** `eval_usage` ### 18. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/packages/six.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/urllib3/packages/six.py` - **Pattern:** `exec_usage` ### 19. auth_flaw - **Details:** Potential security issue (disable_ssl_verify) in .venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py - **File:** `.venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py` - **Pattern:** `disable_ssl_verify` ### 20. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/jinja2/debug.py - **File:** `.venv/lib/python3.12/site-packages/jinja2/debug.py` - **Pattern:** `exec_usage` ### 21. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/jinja2/nodes.py - **File:** `.venv/lib/python3.12/site-packages/jinja2/nodes.py` - **Pattern:** `eval_usage` ### 22. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/jinja2/environment.py - **File:** `.venv/lib/python3.12/site-packages/jinja2/environment.py` - **Pattern:** `exec_usage` ### 23. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/typing_inspection/typing_objects.py - **File:** `.venv/lib/python3.12/site-packages/typing_inspection/typing_objects.py` - **Pattern:** `exec_usage` ### 24. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/anyio/to_interpreter.py - **File:** `.venv/lib/python3.12/site-packages/anyio/to_interpreter.py` - **Pattern:** `exec_usage` ### 25. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/sql/lambdas.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/sql/lambdas.py` - **Pattern:** `exec_usage` ### 26. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/util/langhelpers.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/util/langhelpers.py` - **Pattern:** `exec_usage` ### 27. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/util/typing.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/util/typing.py` - **Pattern:** `eval_usage` ### 28. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/testing/plugin/pytestplugin.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/testing/plugin/pytestplugin.py` - **Pattern:** `exec_usage` ### 29. auth_flaw - **Details:** Potential security issue (exec_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/instrumentation.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/orm/instrumentation.py` - **Pattern:** `exec_usage` ### 30. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/clsregistry.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/orm/clsregistry.py` - **Pattern:** `eval_usage` ### 31. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/sqlalchemy/orm/_orm_constructors.py - **File:** `.venv/lib/python3.12/site-packages/sqlalchemy/orm/_orm_constructors.py` - **Pattern:** `eval_usage` ### 32. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/_internal/_namespace_utils.py - **File:** `.venv/lib/python3.12/site-packages/pydantic/_internal/_namespace_utils.py` - **Pattern:** `eval_usage` ### 33. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/_internal/_typing_extra.py - **File:** `.venv/lib/python3.12/site-packages/pydantic/_internal/_typing_extra.py` - **Pattern:** `eval_usage` ### 34. auth_flaw - **Details:** Potential security issue (eval_usage) in .venv/lib/python3.12/site-packages/pydantic/v1/utils.py - **File:** `.venv/lib/python3.12/site-packages/pydantic/v1/utils.py` - **Pattern:** `eval_usage` --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

blocked:lint-failed

label 2026-05-15 19:38:29 +00:00

Mark added

quickfix

and removed

blocked:lint-failed

labels 2026-05-20 19:54:12 +00:00

Mark referenced this issue from a commit 2026-05-22 13:23:27 +00:00

fix #6: Exclude .venv/ from security scan (all 34 findings were false positives in third-party libs)

Mark 2026-05-22 13:23:27 +00:00

• closed this issue
• added
  triage-approved
  and removed
  quickfix
  labels

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

No results found.

Labels

Clear labels   

blocked:gate-fetch

  

blocked:lint-failed

  

blocked:needs-decision

  

bug

Bug report

  

feature-request

  

in-progress

Kilo runner is actively working on this issue

  

needs-decompose

  

ops-task

  

quickfix

  

triage-approved

Approved by triage pipeline

No labels

blocked:gate-fetch

blocked:lint-failed

blocked:needs-decision

bug

feature-request

in-progress

needs-decompose

ops-task

quickfix

triage-approved

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Mark/itchbox#6

No description provided.